Audit Permissions

Scans all your project-local Claude settings files, aggregates the permissions, and helps you decide what should be promoted to global config. It runs in three phases: first you review candidates and promote what makes sense, then it automatically strips out redundant local permissions that are now covered globally, and finally it flags security risks (like broad curl or rm permissions), policy conflicts with your CLAUDE.md preferences, and one-off cruft like hardcoded paths. The workflow is thoughtfully structured around getting your input at decision points while automating the mechanical cleanup work. Especially useful if you've been adding permissions ad-hoc across projects and want to consolidate without manually diffing dozens of settings files.

GitHub stars: 460
last updated: Jun 7, 2026

View on GitHub

Install

$ npx -y skills add malob/nix-config --skill audit-permissions --agent claude-code

Installs into .claude/skills of the current project.

Files

Audit Claude Permissions

Scan project-local Claude Code settings files, aggregate permission patterns, and recommend promotions to global configuration.

Workflow Overview

This audit runs in three phases, each as a separate task. Use TaskCreate at the start to create all three tasks, then work through them sequentially with user input via AskUserQuestion.

Phase 1: Promote to Global — Requires user judgment. Present candidates, get decisions, apply to global config.
Phase 2: Automated Redundancy Cleanup — Script-driven. After Phase 1 promotions, run cleanup script to remove local permissions now covered by global. Present for sanity-checking, then apply.
Phase 3: Judgment Calls — Everything requiring user input: security hygiene, policy conflicts, one-off cruft, empty file deletion, moderate-risk items.

Initial Setup

Check for symlinked global settings:

readlink -f ~/.claude/settings.json

If the global settings file is a symlink, note the real path. All writes to ~/.claude/settings.json must edit the symlink target, not create a new file that replaces the symlink.

SKILL.md on GitHub